v0.38.4

A fix for deployments shared by several organizations. A single-operator install, the default, is unchanged. Nothing to do when you upgrade.

What changed

On a deployment shared by several organizations, the model broker calls each organization's own connection. That call now goes only to an address that resolves outside the deployment's own networks, which is the rule an MCP server's address already follows.

• An address that can't be used as written is refused before any lookup. That covers anything that isn't http or https, has no host, contains a user name or password, or contains a ? or #.
• The name is resolved once, and every address it answers with is classified. The socket opens only to one of those addresses, so the address that was checked is the address that's connected to.
• A refused call answers 403 with the reason, on the first attempt and on a retry.

These are unchanged: the operator's own connections, the platform's connections, and an install where one operator runs everything (_pool_is_local()), which is the default.

Checked

• Tests (gateway/tests/test_broker_org_address.py): every refusal case fails on 0.38.3 and passes here, and the unchanged cases pass on both.
• On 0.38.4-rc.1, running as a shared deployment with real name lookups:
  • names that resolve to a loopback, link-local or private address are refused, and no socket opens;
  • a public provider is reached at an address its name resolved to, and it answers.

Full Changelog: v0.38.3...v0.38.4